SEC tightens rules around data breach disclosures

SEC tightens rules around data breach disclosures
Updates to a 24-year-old rule will require firms, including broker-dealers and RIAs, to prevent cyber risks and notify clients of incidents.
MAY 16, 2024

The SEC is sharpening its focus on cybersecurity breaches at broker dealers and RIAs, among other financial institutions, with an update to a 24-year-old rule.

In a move to modernize regulation around how certain institutions handle customers’ nonpublic personal information, the federal agency announced Thursday that it has adopted critical amendments to Regulation S-P.

This move is intended to address the growing risks associated with technological advancements since the rule's initial adoption in 2000. Under the amendments, broker-dealers, investment companies, registered investment advisers, and transfer agents will have to meet new requirements to safeguard customer data.

 “Over the last 24 years, the nature, scale, and impact of data breaches has transformed substantially,” SEC Chair Gary Gensler said in a statement. “These amendments to Regulation S-P will make critical updates to a rule first adopted in 2000 and help protect the privacy of customers’ financial data.”

Among the updates to Regulation S-P, covered institutions are mandated to establish written policies and procedures for an incident response program. This program must include measures to detect, respond to, and recover from unauthorized access to or use of customer information.

With certain limited exceptions, the new rules also require firms to notify affected individuals, or those reasonably likely to have been affected, as soon as practicable, but no later than 30 days after the institution becomes aware of a breach.

In providing notice to impacted customers, institutions must detail the incident, the compromised data, and steps individuals can take to protect themselves, the SEC said.

“The basic idea for covered firms is if you’ve got a breach, then you’ve got to notify,” Gensler said. “That’s good for investors.”

Last July, Schwab disclosed a breach linked to the high-profile MOVEit software cyberattack, potentially exposing the data of tens of thousands of clients on its platform and that of its subsidiary TD Ameritrade.

In March, Finra slapped Osaic and Securities America with separate $150,000 fines over cybersecurity and data protection failures that ran from January 2021 up to that month. Those shortfalls, it said, constituted violations of Regulation S-P.

In a filing to the Office of the Maine Attorney General earlier this month, JPMorgan reported it had discovered a vulnerability that affected over 451,000 participants in its retirement plans.

SEC’s newly announced amendments will become effective 60 days after their publication in the Federal Register.

Larger firms have 18 months from the date of publication to comply with the new regulations, while smaller entities will have a longer 24-month window to become compliant.

Latest News

‘No detractor’ to using direct indexing as an investment strategy
‘No detractor’ to using direct indexing as an investment strategy

Thirty four percent of advisors surveyed by InvestmentNews say they use direct indexing strategies but 39 percent don’t.

After watching advisors bolt, B. Riley now losing investment bankers
After watching advisors bolt, B. Riley now losing investment bankers

“This is on the B. Riley Securities side of the business, the dealmaking side,” one senior industry executive said.

Does sell and stay really work?
Does sell and stay really work?

There are three essential elements you must bring to the table to increase the chances of a successful post-sale career.

Retirement savings rise with two account types posting record highs
Retirement savings rise with two account types posting record highs

Across generations, how are savers doing with their 401(k) contributions?

What's making America's billionaires richer, faster?
What's making America's billionaires richer, faster?

New report shines some light on today's billionaires' investments.

SPONSORED How MRP’s Synthetic Equity is balancing growth and protection for advisors

"Synth Equity has been such a tailwind for these advisors who really understand the story," Measured Risk Portfolios’ head of distribution said.

SPONSORED The future of prospecting: Say goodbye to cold calls and hello to smart connections

Streamline your outreach with Aidentified's AI-driven solutions